Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

WizLearn Technologies LMS – Authentication Bypass Vulnerability Could Allow Unauthorised Access and Administrative Control

23 October 2026

A vulnerability has been discovered in WizLearn Technologies’ Learning Management System (LMS). WizLearn Technologies has since implemented the necessary measures to address the vulnerability. Special thanks to the researcher and WizLearn Technologies for coordinating through CSA's Responsible Vulnerability Disclosure Policy.

Background 

WizLearn Technologies Pte Ltd is a Singapore-based educational technology (EdTech) company specialising in e-learning solutions and Learning Management Systems (LMS). The company provides digital learning platforms that enable educational institutions and organisations to deliver, manage and track online training programmes. 

CVE ID – Description 

CVE-2026-63244 | 9.8 (CRITICAL) – An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform. 

Affected Products 

Mitigation

WizLearn Technologies has taken the following immediate remedial actions:

  • Disabled Google and Facebook social login on WizLearn LMS.

  • Invalidated all active user sessions as a precautionary measure.

  • Social login functionality will not be re-enabled until secure server-side OAuth token verification has been properly implemented and validated.

Timeline

  • 2026-10-05 – Vendor Disclosure

  • 2026-10-05 – Vendor Mitigated

  • 2026-10-09 – Public Release

Credits

Discovered by Manzel Seet from Assurity Trusted Solutions